Extracted

• • Target
    0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55
  • Size 1.1MB
  • SHA256 0b3e8d60c4cf6855058823ac0936b99c3123123b3b8b220e57dd6119e5b04a55
  • MD5 b144fe12ff36f576e02765e348a5c894
  • SHA1 078068df2405d2af406df2deb7e5fa8b688ec096
  • SHA512 9dc482dc3a2f21701344acd3413742f801a901913d7e0b2af2de310671532f3a6762cd446ee2a27bfcc08fc016c68d1fdf1a751a5a75bfc243f03c019e8ffa0d
  • SSDEEP 12288:UMhn46Yd4FxerPgETvQZKPudo2R+EA+8c7HCeSv7r8dNgt9A1UjvVQ3s0S5/gI1O:N4u/eLJPudokBA1TwS0hfmhs
  • TLSH
    T153450624BABA816CC063F7785DEEE55FEABA7A050644A56F014513170F3ABD08B1733E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasionevasionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2